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WHAT IS CLAIMED IS : 

1 . A method of upgrading application software on a fault tolerant system having 
a first engine and a second engine, the first and second engine executing an 
application, the method comprising: 

taking the second engine out of service; 

upgrading the application on the second engine; 

assigning the second engine as a standby engine to the first engine and 
receiving run state updates from the first engine; 

assigning the first engine as the standby engine to the second engine and 
receiving run state updates from the second engine; and 

upgrading the application on the first engine. 

2. The method of claim 1 , wherein said upgrading the application on the second 
engine comprises disabling new features of the upgraded application. 

3. The method of claim 1 , wherein said upgrading the application on the first 
engine comprises disabling new features of the upgraded application. 

4. The method of claim 1 , further comprising enabling new application features 
on the first and second engine. 

5. The method of claim 1 , wherein said assigning the first engine as a standby to 
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the second engine comprises determining if the upgraded software is acceptable. 

6. The method of claim 5, wherein if said upgraded software is not acceptable, 
assigning the first engine as an active engine. 

7. The method of claim 5, wherein if said upgraded software is acceptable, 
taking the first engine out of service. 

8. The method of claim 1 , wherein the application comprises at least one work 

unit. 

9. The method of claim 8, wherein the run state updates comprise a description 
of the at least one work unit. 

10. The method of claim 8, wherein said first engine and second engine operate 
in synchronization. 

1 1 . A method for upgrading application software on a fault tolerant system 
having an active engine and a standby engine, said method comprising: 

determining if said active engine and said standby engine are executing different 
versions of said application software; 

sending a description of work units from the active engine to the standby engine; 
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sending database activities from the active engine to the standby engine. 



12. The method of claim 1 1 , further comprising: 
registering the work units at the standby engine. 

13. The method of claim 1 1 , further comprising: 

sending a step-up signal from the active engine to the standby engine with the 
description of work units. 

14. The method of claim 1 1 , wherein the application software comprises the 
work units. 

1 5. A fault tolerant system comprising: 
a first engine; 

a second engine; 

a computer readable memory that stores instructions that when executed by said 
first and second engine cause the fault tolerant system to: 

designate said first engine as an active engine and said second engine as 
a standby engine; 

determine if said active engine and said standby engine are executing 
different versions of an application software; 
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send a description of work units from said active engine to said standby 

engine; and 

send database activities from said active engine to said standby engine. 

16. The system of claim 1 5, said instructions further causing said first and 
second engine to: 

register the work units at the standby engine. 



17. The system of claim 15, said instructions further causing said first and 
second engine to: 



18. The system of claim 1 5, wherein the application software comprises the work 



send a step-up signal from the active engine to the standby engine with the 



description of work units. 




units. 
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